Toros Workshop LLC d/b/a Toros Laboratories operates the Chiru app and chiru.io. We are a data controller under GDPR. For privacy questions: privacy@chiru.io
Account data: email address, display name, content niche (optional).
Platform tokens: OAuth tokens for connected platforms — encrypted with AES-256-GCM before storage.
Post data: captions, hashtags, scheduling preferences, publishing settings.
Media (video/images): when you publish immediately, your media streams directly from your device to each platform — it is never written to our servers. When you schedule a post for later, your media must be held somewhere until the scheduled time (your device isn't there to send it), so we store it temporarily, encrypted at rest, and delete it automatically the moment it publishes or after 30 days if the post is never published — whichever comes first.
Analytics: views, likes, comments, shares, saves, reach, and (for YouTube) watch time and audience retention, read from each platform's official API for your published posts and your connected accounts, to power your analytics dashboard.
Usage data: features used, screens visited, session duration, errors (via Sentry).
Consent records: your cookie and privacy choices and the timestamps at which you accepted our Terms and this Policy, kept to demonstrate compliance.
We never collect: your full IP address (only 2 octets stored), full device/browser information, GPS location, or biometric data.
Chiru connects to your social platforms through their official APIs, on your behalf, to publish your content, read your posts' statistics and comments, and show your analytics. We only ever access your own accounts and the content you publish through Chiru, never anyone else's.
This application uses YouTube API Services. When you connect YouTube, you access YouTube content and features that are subject to the YouTube Terms of Service. Chiru uses these services to upload videos you choose to publish, read your own video and channel statistics, moderate comments on your own videos, and display your YouTube performance analytics (watch time and audience retention).
Chiru's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google's own handling of your data is described in the Google Privacy Policy.
You can revoke Chiru's access to your Google and YouTube data at any time by disconnecting YouTube inside Chiru, or through your Google security settings.
To provide the Service, process payments, send transactional emails, improve the product, ensure security, and comply with legal obligations. We do not use your data for advertising or sell it to any third party.
Chiru may aggregate anonymized hashtag usage across all users to power trending hashtag suggestions. This aggregate data cannot be traced back to any individual user or post — we do not store post identifiers, user identifiers, or any other information that could link a trending statistic back to a specific person.
Regional trending data is based on the country you provide in your profile settings, not your device location or IP address. If you have not set a country in your profile, your activity is included in global trends only.
Country and region information is self-reported by users and is not verified by Chiru. We do not guarantee the accuracy of this information, and trending data shown by region reflects whatever country users have chosen to provide. This feature is intended to enhance privacy by avoiding location tracking, not to guarantee geographic accuracy.
To protect individual privacy, regional trends are only shown when a sufficient number of distinct users have contributed to that data point. If too few users in a region have used a hashtag, Chiru will show global trends instead.
We share data only to operate the Service, with the following sub-processors: Supabase (database & authentication), Railway (application hosting), Cloudflare (media pass-through/R2, CDN, and edge functions), Stripe and Paddle (payment processing), Resend (transactional email), Sentry (error monitoring), and — for in-app creative features — Klipy (sticker search) and Pixabay (music search). All processors are bound by data processing agreements.
We never sell, license, or share your data with advertisers, data brokers, or external parties for commercial purposes.
Account data: duration of account + 90 days after deletion. OAuth tokens: until platform is disconnected. Payment records: 7 years (legal requirement). Product analytics: anonymized after 90 days, deleted after 1 year. Retention is enforced automatically in code nightly.
Usage and Billing Data. Usage audit logs, including X (Twitter) posting activity, spending limit changes, and team member actions, are retained for 24 months to support billing dispute resolution and platform integrity verification. X posting cost records are retained for 7 years to comply with financial record-keeping requirements.
You have the right to access, correct, delete, and export your data. Use these in-app: Profile → Settings → Download My Data or Delete Account. Or email privacy@chiru.io. We respond within 30 days.
Data export: requesting your data generates a machine-readable export of your account, posts, analytics, and connection metadata, delivered to your account email; the download link is valid for a limited time.
Account deletion (30-day grace): when you delete your account, we begin a 30-day grace period during which the request can be reversed by contacting us. After 30 days your account data is permanently erased and all platform OAuth tokens are revoked. Content you already published to third-party platforms is not affected and must be removed on those platforms directly.
Meta (Instagram/Facebook) data deletion: if you connected Instagram or Facebook, you can also request deletion from Facebook (Settings → Apps and Websites → remove Chiru), or email privacy@chiru.io. Meta-connected data is deleted within 30 days; you can check status at chiru.io/data-deletion-status.
EU/UK users have additional GDPR rights including objection and restriction. California users have CCPA rights. Brazilian users have LGPD rights. See our full policy at chiru.io/privacy for jurisdiction-specific details.
Chiru is not directed to children under 13. We do not knowingly collect data from children under 13. Contact privacy@chiru.io if you believe a child has created an account.
OAuth tokens encrypted at rest (AES-256-GCM). All data in transit uses TLS 1.2+. Row-level security enforced at the database layer. No full IP addresses stored. No behavioral advertising SDKs.
We will notify you 14 days before material changes via email and in-app notification.
Toros Workshop LLC d/b/a Toros Laboratories
4030 Wake Forest Road STE 349, Raleigh, NC 27609, United States
General: ctrl@chiru.io · Privacy: privacy@chiru.io
Data Protection Officer: Charles Alvarado — ctrl@toroslaboratories.com
4030 Wake Forest Road STE 349, Raleigh, NC 27609, United States
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you specific rights regarding your personal information:
Right to Know — You may request information about the categories of personal information we collect, the purposes for which we use it, and whether we share it with third parties.
Right to Delete — You may request that we delete the personal information we have collected about you, subject to certain exceptions.
Right to Opt-Out of Sale — Chiru does not sell your personal information to third parties. We do not sell your data.
Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights. Exercising these rights will not affect your ability to use Chiru.
How to Submit a Request — To exercise any of these rights, contact us at privacy@chiru.io. We will respond within 45 days. For verification purposes, we may ask you to confirm your email address.